Activerecord
Approved changes feed: RSS · Atom
cpe:2.3:a:activerecord_project:activerecord:*:*:*:*:*:ruby:*:*
part: a version: * update: *
| Vendor | Activerecord Project (2cace29e-44be-514c-af29-30f93030acf3) |
|---|---|
| Product | Activerecord (168d9076-3432-50bf-a48b-566af57b206b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | ruby |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:gem/activerecord |
purl2cpe | 2026-06-01 10:17:16.795367 |
pkg:github/rails/rails |
purl2cpe | 2026-06-01 10:17:16.795369 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-22794 |
vulnerable | 2026-06-03 14:49:20.218839 |
Details available
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.
Published: 2023-02-09T00:00:00.000Z
Updated: 2024-08-02T10:20:30.748Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-44566 |
vulnerable | 2026-06-03 14:48:17.281022 |
Details available
A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service.
Published: 2023-02-09T00:00:00.000Z
Updated: 2025-03-25T13:43:54.894Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-32224 |
vulnerable | 2026-06-03 14:47:20.957584 |
Details available
A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.
Published: 2022-12-05T00:00:00.000Z
Updated: 2026-05-11T16:53:19.403Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.